Atlassian Corporation: 10-K Risk Factor Changes

Regulation related to the provision of services over the internet continues to evolve, as federal, state and foreign governments continue to adopt new, or modify existing, laws and regulations addressing data privacy, cybersecurity, data protection, cloud sovereignty and the collection, processing, storage, hosting, transfer, use and other processing of data. The volume, complexity and scope of these regulatory requirements may continue to increase, including in response to heightened geopolitical tensions. In the United States, the Federal Trade Commission and state regulators enforce a variety of data privacy issues, such as promises made in privacy policies or failures to appropriately protect information about individuals, as unfair or deceptive acts or practices in or affecting commerce in violation of the Federal Trade Commission Act or similar state laws. In addition, U.S. state data privacy laws, such as the California Consumer Privacy Act as amended by the California Privacy Rights Act

25

(“CPRA”), and similar laws that have passed, gone into effect, or are being considered in many other U.S. states, impose obligations on us and many of our customers, potentially as both businesses and service providers.

In the European Economic Area (“EEA”) and the UK, data privacy laws and regulations, such as the European Union General Data Protection Regulation (“EU GDPR”) and United Kingdom General Data Protection Regulation and Data Protection Act 2018 (collectively, the “UK GDPR,” and, together with the EU GDPR, the “GDPR”), impose comprehensive obligations directly on Atlassian as both a data controller and a data processor, as well as on many of our customers, in relation to our collection, processing, sharing, disclosure and other use of personal data. Data privacy laws and regulations around the globe continue to evolve and expand, and as various jurisdictions continue to introduce legislation or regulation (such as India’s Digital Personal Data Protection Act), we and our customers could be exposed to additional regulatory burdens that could increase our costs, reduce usage of our offerings, and adversely affect our business and results of operations.

As our Cloud offerings continue to become more central to our distribution model, particularly in light of our Data Center end-of-life plans, we may face additional privacy risks, including risks stemming from regulation of cloud computing. For example, the transition to Cloud offerings may be impacted by emerging EU cloud sovereignty requirements that could disadvantage our Cloud offerings in public sector organizations and regulated industries. We may also be subject to increased data security risks as customers increasingly transition from self-managed environments to our Cloud platform. And, recent governmental actions and geopolitical developments have increased the perceived risk that our offerings, particularly in the EU, could be disrupted, suspended or terminated.

We are also subject to evolving privacy laws on cookies and similar tracking technologies and e-marketing. Certain U.S. states and foreign jurisdictions, such as Australia, Canada, and the EU, have enacted laws regulating electronic communications and data collection, some more restrictive than U.S. laws, and the placement and use of cookies and similar technologies are subject to consent requirements across several of these jurisdictions. Recent European court and regulatory decisions have intensified scrutiny around compliance with these requirements, and there has been active civil litigation alleging improper data collection through such technologies in our industry. From time to time we have been and may be subject to legal claims related to these practices. These developments could restrict our ability to process data, reach customers, and derive insights from customer data, and have in the past, and may in the future result in additional compliance and operational costs.

In addition, various safe harbors have historically been provided to those who hosted content provided by others, such as safe harbors from monetary damages for copyright infringement arising from copyrighted content provided by customers and others, and for defamation and other torts arising from information provided by customers and others. There is an increasing demand for repealing or limiting these safe harbors by either judicial decision or legislation. Loss of these safe harbors may require altering or limiting some of our services or may require additional contractual terms to avoid liabilities for our customers’ misconduct.

We monitor the regulatory, judicial, and legislative environment and have invested in addressing these developments. These new laws may require us to make additional changes to our practices and services to enable us or our customers to meet the new legal requirements, and may also increase our potential liability exposure through new or higher potential penalties for noncompliance. To date, we have not been subject to any material penalties for non-compliance with any such legal requirements, but there can be no assurance that any future penalties will not be material or significant. In addition, changes to penalties, fines, and action related to data breaches could impact our potential liability exposure. Record-breaking enforcement actions globally have shown that regulators wield their right to impose substantial fines for violations of technology regulations, and these enforcement actions could result in guidance from regulators that would require changes to our current compliance strategy.

Furthermore, privacy laws and regulations are subject to differing interpretations and may be inconsistent among jurisdictions. These and other requirements are causing increased scrutiny among customers, particularly in the public sector and highly regulated industries, and may be perceived differently from customer to customer. These developments could reduce demand for our services, require us to take on more onerous obligations in our contracts, restrict our ability to store, transfer and process data, require us to fundamentally change our business activities and practices or modify our products, or, in some cases, impact our ability or our customers’ ability to offer our services in certain locations, to deploy our solutions, to reach current and prospective customers, or to derive insights from customer data globally. For example, in July 2020, the Court of Justice of the European Union (“CJEU”) invalidated the EU-U.S. Privacy Shield Framework, one of the mechanisms that allowed companies, including Atlassian, to transfer personal data from the EEA to the United States. Even though the CJEU decision upheld the Standard Contractual Clauses as an adequate transfer mechanism, the decision created uncertainty around the validity of all EU-to-U.S. data transfers. The EU and U.S. governments later established the EU-U.S.

26

Data Privacy Framework to foster EU-to-U.S. data transfers and address the concerns raised in the aforementioned CJEU decision. As recent court decisions modify the dynamics of regulatory bodies, there is uncertainty whether the EU-U.S. Data Privacy Framework may be at risk of being overturned. Certain countries outside of the EEA have also passed or are considering passing laws requiring varying degrees of local data residency. For example, statutory damages available through a private right of action for certain data breaches under the CPRA and potentially other U.S. states’ laws may increase our and our customers’ potential liability and the demands our customers place on us. As another example, more jurisdictions are considering legal frameworks on AI, a trend that may continue to increase as the EU AI Act progresses through its implementation period and several similar laws have been passed in various jurisdictions.

The costs of compliance with, and other burdens imposed by, privacy laws, regulations and standards may limit the use and adoption of our services, reduce overall demand for our services, make it more difficult to meet expectations from our commitments to customers and our customers’ users, lead to significant fines, penalties or liabilities for noncompliance, impact our reputation, or slow the pace at which we close sales transactions, in particular where customers request specific warranties and unlimited indemnity for noncompliance with privacy laws, any of which could harm our business. We have adopted and continue to adopt data residency in certain territories. These services may enhance our ability to attract and retain customers operating in the relevant jurisdictions, but may also increase the cost and complexity of supporting those customers, the scope of our residency offering may not align with customer needs, and our customers may request similar offerings in other territories. Our data residency controls may at times fail, exposing us to fines, penalties, civil actions, or other harm.

In addition to government activity, privacy advocates and other industry groups have established or may establish new self-regulatory standards that may place additional burdens on our ability to provide our services globally. Our customers expect us to meet voluntary certification and other standards established by third parties. If we are unable to maintain these certifications or meet these standards, it could adversely affect our ability to provide our solutions to certain customers and could harm our business. In addition, we have experienced certain, and overall seen a trend toward, private enforcement of data protection obligations, including through private actions for alleged noncompliance, which could harm our business and negatively impact our reputation. In addition, a shift in consumers’ data privacy expectations or other social, economic, or political developments could impact the regulatory enforcement of privacy regulations, which could require our cooperation and increase the cost of compliance with the imposed regulations.

Further, any failure or perceived failure by us to comply with our posted privacy policies, our privacy-related obligations to users or other third parties, or any other legal obligations or regulatory requirements relating to privacy, data protection or information security may result in governmental investigations or enforcement actions, litigation, claims or public statements against us by consumer advocacy groups or others and could result in significant liability, cause our users to lose trust in us, and otherwise materially and adversely affect our reputation and business. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations and policies that are applicable to the businesses of our users may limit the adoption and use of, and reduce the overall demand for, our platform. Additionally, if third parties we work with violate applicable laws, regulations or agreements, such violations may put our users’ data at risk, could result in governmental investigations or enforcement actions, fines, litigation, claims, or public statements against us by consumer advocacy groups or others and could result in significant liability, cause our users to lose trust in us and otherwise materially and adversely affect our reputation and business. To date, any such actions or investigations have not been material to the Company’s operations, but there can be no assurance that any future actions or investigations will not be material or significant. Further, public scrutiny of, or complaints about, our data handling or data protection practices, may also lead to increased regulatory scrutiny or cause our customers to seek alternative products or services. Complaints about the practices of technology companies in general, even if unrelated to our business or operations, may also lead to increased scrutiny of technology companies, including us, and may cause government agencies to enact additional regulatory requirements, or to modify their enforcement or investigation activities, which may increase our costs and risks.

New laws, guidance or decisions related to AI, as well as the related increased regulatory scrutiny in recent years, may limit our ability to use our AI solutions, apps, agents and features, or require us to make changes to our operations that may decrease our operational efficiency, result in an increase to operating costs or hinder our ability to improve our services. While the GDPR already provides for transparency obligations and the imposition of safeguards where automated decision-making is used in certain circumstances, a number of U.S. state data privacy laws that have passed, gone into effect, or are being considered similarly impose transparency obligations and provide the right for data subjects to opt-out of profiling that will have legal or similarly significant effects. As these laws continue to evolve, we and our customers could be exposed to additional regulatory burdens that could

27

increase our costs, reduce usage of our apps or agents, and adversely affect our business and results of operations.

Finally, the uncertain and shifting regulatory environment and trust climate may raise concerns regarding data privacy and cybersecurity, which may cause our customers or our customers’ users to resist providing the data necessary to allow our customers to use our services effectively. In addition, new products we develop or acquire or new services we offer may expose us to liability or regulatory risk. Even the perception that the privacy and security of personal information are not satisfactorily protected or do not meet regulatory requirements could inhibit sales of our offerings or services and could limit adoption of our cloud offerings.